Overview

overview

3

Static

static

3

Payment_Reminder.pdf

windows10-2004-x64

3

Payment_Reminder.pdf

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    abx_CloudMessage_WzE0MTgsICIzYmU4OGM3Yy02NzQyLTQwMTAtYTgzZS03NTRjNjIzMmM3ZjRAMzU0ZjEwYTUtMDc4Mi00NjYzLTg4OTctOGI2MDc0N2ViOGJjIiwgIkFBa0FMZ0FBQUFBQUhZUURFYXBtRWMyYnlBQ3FBQy1.eml
  • Size 20KB
  • Sample261009-ppm71sgt2x
  • SHA256 dea1640831085d9544736efa403b4684155c708048889ab3d2a4f1733ecfa6ae
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
pdflink

Malware Config

Signatures

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

    pdflink

File Explorer

  • abx_CloudMessage_WzE0MTgsICIzYmU4OGM3Yy02NzQyLTQwMTAtYTgzZS03NTRjNjIzMmM3ZjRAMzU0ZjEwYTUtMDc4Mi00NjYzLTg4OTctOGI2MDc0N2ViOGJjIiwgIkFBa0FMZ0FBQUFBQUhZUURFYXBtRWMyYnlBQ3FBQy1.eml
    .eml 20KB
  • Payment_Reminder.pdf
    .pdf 2KB
  • email-html-1.txt
    130B

abx_CloudMessage_WzE0MTgsICIzYmU4OGM3Yy02NzQyLTQwMTAtYTgzZS03NTRjNjIzMmM3ZjRAMzU0ZjEwYTUtMDc4Mi00NjYzLTg4OTctOGI2MDc0N2ViOGJjIiwgIkFBa0FMZ0FBQUFBQUhZUURFYXBtRWMyYnlBQ3FBQy1.eml

  • SHA256 dea1640831085d9544736efa403b4684155c708048889ab3d2a4f1733ecfa6ae
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Mon, 28 Sep 2026 11:56:16 +0000

Subject

[External] RE: Can You Confirm If This Invoice Was Paid?

Content-Type

multipart/mixed; boundary="--_NmP-f9678cf3a7450b90-Part_1"

Received

from PH8PR03MB989576.namprd03.prod.outlook.com (2603:10b6:510:40c::23) by MN2PR03MB4749.namprd03.prod.outlook.com with HTTPS; Tue, 29 Sep 2026 17:47:01 +0000

from BL1PR13CA0083.namprd13.prod.outlook.com (2603:10b6:208:2b8::28) by PH8PR03MB989576.namprd03.prod.outlook.com (2603:10b6:510:40c::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.24; Tue, 29 Sep 2026 17:45:55 +0000

from BN2PEPF0000449F.namprd02.prod.outlook.com (2603:10b6:208:2b8:cafe::5b) by BL1PR13CA0083.outlook.office365.com (2603:10b6:208:2b8::28) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Tue, 29 Sep 2026 17:45:55 +0000

from atl0appcp003.assurant.com (167.79.177.83) by BN2PEPF0000449F.mail.protection.outlook.com (10.167.243.150) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Tue, 29 Sep 2026 17:45:54 +0000

from pps.filterd (atl0appcp003.assurant.com [127.0.0.1]) by atl0appcp003.assurant.com (8.18.1.11/8.18.1.11) with ESMTP id 68TE6LC42727465 for <[email protected]>; Tue, 29 Sep 2026 13:45:54 -0400

from atl0appcp001.assurant.com (atl0appcp001.assurant.com [10.100.110.47]) by atl0appcp003.assurant.com (PPS) with ESMTPS id 4gxxrd6e9c-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for <[email protected]>; Tue, 29 Sep 2026 13:45:54 -0400 (EDT)

from pps.filterd (atl0appcp001.assurant.com [127.0.0.1]) by atl0appcp001.assurant.com (8.18.1.11/8.18.1.11) with ESMTP id 68THjs7t1455002 for <[email protected]>; Tue, 29 Sep 2026 13:45:54 -0400

from mail-wm2-f13.google.com (mail-wm2-f13.google.com [74.125.225.141]) by ord3appcp003.assurant.com (PPS) with ESMTPS id 4gyqq8g12w-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for <[email protected]>; Mon, 28 Sep 2026 07:56:19 -0400 (EDT)

by mail-wm2-f13.google.com with SMTP id 5b1f17b1804b1-49e6b885ef8so16171525e9.1 for <[email protected]>; Mon, 28 Sep 2026 04:56:19 -0700 (PDT)

from [127.0.0.1] ([77.245.76.110]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49ffabc3f33sm173943975e9.4.2026.09.28.04.56.16 for <[email protected]> (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 28 Sep 2026 04:56:17 -0700 (PDT)

X-Received

by 2002:a05:600c:468d:b0:49f:f9d1:e618 with SMTP id 5b1f17b1804b1-49ff9d1e6b1mr105439765e9.17.1790596577866; Mon, 28 Sep 2026 04:56:17 -0700 (PDT)

Received-Spf

SoftFail (protection.outlook.com: domain of transitioning gmail.com discourages use of 167.79.177.83 as permitted sender)

Message-Id

<[email protected]>